ABOUT THIS EPISODE
What if GRC shouldn’t sit inside Security at all—and what if the bigger problem isn’t automation, but what you do after you automate? In this episode, Raj Krishnamurthy sits down with Charles Nwatu (former Security GRC Engineering & Assurance leader at Netflix) for a candid, systems-level conversation about why “annual audit rituals” fail modern engineering, how GRC can produce high-fidelity signals that strengthen security decision-making, and why the next wave of GRC engineering is about analytics, specifications, and business impact—not just speeding up evidence collection.
Key Takeaways:
- GRC is a continuous discipline—point-in-time compliance can help, but it can’t be the end state.
- Automation is necessary but not sufficient: the real value is in turning collected evidence into actionable insights.
- Specifications enable measurement—without clear expected behaviors, security metrics become inconsistent and hard to compare.
- GRC can feed security with high-fidelity signals (like identity/access review metadata) that improve posture beyond audit readiness.
- Third-party risk doesn’t “finish”—the goal is visibility, data lineage awareness, and making the mess less messy.
What You’ll Learn:
- Where Charles believes GRC should sit org-wise—and why Security should be a “customer” of GRC
- What “shift-left GRC” looks like in practice (beyond annual audits)
- Why “efficiency savings” don’t automatically equal “security value”
- How to think about metrics, specifications, and risk in a shared language
- Why third-party risk management is “unsolvable,” and how to build guardrails anyway
This podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence.
Learn more: https://www.compliancecow.com
Watch more episodes: https://www.compliancecow.com/podcast
Connect With Our Guest:
Charles Nwatu | GRC Engineering Leader
Connect on LinkedIn: https://www.linkedin.com/in/cnwatu/
Rate, review, and share if you enjoyed the show!
Subscribe to Security & GRC Decoded wherever you get your podcasts:
Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683
Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450
